An agent on your network is a serious thing to ask for
This page describes the agent’s permissions, the data it can collect, and the choices that depend on your deployment. Software controls, operational practices, and disclosure targets have different limits. Check the version and configuration you run against these descriptions.
What it can and cannot do
Enforced in software
- Local execution grants and operating-system permissions limit what the installed agent can do. Remote script setup cannot exceed the script mode permitted in the host’s service configuration.
- Managed test reports are checked against the reporting agent’s authorized assignments. Built-in agent health and local network context are also collected.
- Enrollment yields a credential belonging to one agent. Revoking it does not disturb any other agent.
- Control-plane connections originate from the agent. The agent does not expose an inbound control-plane listener.
- Current agents verify signatures on remote command responses and downloaded bundle manifests, and check the bundle’s size and digest. Older agents use a limited legacy update path; installed versions matter.
Capabilities to review
- Custom script checks can run remotely supplied code, including host interpreter commands when locally permitted. Granting that access means trusting the people and systems that configure those checks.
- The agent is not always unprivileged. Some supplied service and Kubernetes configurations run it as root or a privileged service account. Review the installer, service identity, host access and granted capabilities.
- Optional syslog collection opens a configured TCP or UDP listener. The real-user browser integration uses an authenticated loopback listener. Review these separately from outbound control traffic.
- Path probing is not general traffic recording. Configured application checks, screenshots, scripts and log captures can contain content; review what you enable.
- Authorized operators can request agent and plugin updates remotely. A signed update replaces executable code; it is part of your trust boundary. Use the local -disable-remote-updates flag if binaries must be managed only on the host.
What we hold, and where
- What measurements contain
- Addresses, hostnames, routing metadata, timings and trust qualifiers. Configured application checks, browser screenshots, scripts and log excerpts can also contain application content and personal information.
- Encryption
- Transport and storage protections depend on deployment configuration, including TLS endpoints, database and backup encryption, and credential handling. Confirm the controls applicable to your hosted or self-hosted environment.
- Account isolation and sharing
- The API applies account scope and permissions to measurement access. Public observations can be shared across eligible subscriptions. Sharing a private agent with another account requires an explicit grant; organization membership alone is insufficient.
- Operator support access
- In the current source, support impersonation requires a named operator, a reason and a stored operator audit record before issuing a single-use link. Links expire after two minutes; exchanged sessions last up to one hour and display a banner to the operator. Customer approval, notification and a customer-visible support access history are not enforced by this workflow.
- Retention
- Set by your plan on cloud, and by you on self-hosted. Raw samples and rollups age out independently.
- Deletion
- Return and deletion follow the applicable agreement and retention rules. Backups and usage-integrity identifiers have separate lifecycles. Self-hosted customers control local data; support and enabled integrations can transmit data elsewhere.
Reporting a vulnerability
If you have found a security issue in RouteSpear, please tell us before you tell anyone else, and we will treat it as the priority it is.
Email security@routespear.com with enough detail to reproduce it. If you would rather encrypt it, say so first and we will exchange keys.
Our response targets are listed here so you know what to expect. They are operational goals, not automated controls or guaranteed response times. Please keep reproduction details private while we coordinate a fix and disclosure.
Please do not test against other customers' data or run denial-of-service attempts against production. Anything else done in good faith to find a real issue is welcome, and we will not pursue you for it.
Disclosure targets
- Acknowledgement
- Target: 2 business days
- Initial assessment
- Target: 5 business days
- Status updates
- Target: every 10 days
- Credit
- Offered, unless declined
Where we actually are
This page does not claim SOC 2 certification or a completed SOC 2 examination. If your procurement process requires an independent assurance report, request current evidence directly from us; a product description or roadmap is not that evidence.
In the meantime, if your procurement process needs a security questionnaire completed, an architecture review, or a conversation with someone who wrote the code, ask and we will arrange it. Self-hosting gives you control over the deployment, but does not by itself prevent outbound data transfers. Review enabled AI providers, notifications, support, update downloads and external map resources against your network policy.